update rails for sql injection bug